An organization's security strategy has traditionally been defined, implemented, and updated by domain experts [1]}. Although this approach can provide basic security for an organization's communication and computing infrastructure, a growing concern is that infrastructure update cycles become shorter and attacks increase in sophistication [2]}, [3]}. Consequently, the security requirements become increasingly difficult to meet. To address this challenge, significant efforts have started to automate security processes and functions. Examples of this research include: automated creation of threat models [4]}; computation of defender policies using dynamic programming and control theory [5]}, [6]}; computation of exploits and corresponding defenses through evolutionary methods [7]}; identification of infrastructure vulnerabilities through attack simulations and threat intelligence [8]}, [9]}; computation of defender policies through game-theoretic methods [10]}, [11]}; and use of machine learning techniques to estimate model parameters and policies [12]}, [13]}.
